PT-2026-34878 · Unknown · Codechecker

Scott Tolley · CVE-2026-25660 · Published 2026-04-24 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodeChecker versions prior to 6.27.4

Description An authentication bypass exists in CodeChecker, an analyzer tooling, defect database, and viewer extension for the Clang Static Analyzer and Clang Tidy. The issue occurs when the URL ends with Authentication in conjunction with certain function calls, allowing an attacker to assign arbitrary permissions to any existing user.

Recommendations Update to a version newer than 6.27.3.

Exploit

Fix

Authentication Bypass by Spoofing

Incorrect Authorization

Weakness Enumeration

CWE-290

CWE-863

Related Identifiers

CVE-2026-25660

GHSA-4V9X-CQC5-J645

PYSEC-2026-317

Affected Products

Codechecker

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25660.json · Exploit
• https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-317 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25660 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4v9x-cqc5-j645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25660 · Security Note
• https://github.com/Ericsson/codechecker · Note
• https://github.com/advisories/GHSA-4v9x-cqc5-j645 · Note
• https://pypi.org/project/codechecker · Note
• https://twitter.com/CVEnew/status/2048099288635318294 · Twitter Post